WordPress security articles, guides, and announcements.
Most WordPress security tools charge a monthly subscription before you can do anything useful. WP Vanguard takes a different approach: the tools you need to stay informed about your site's security an...
Wordfence disclosed an arbitrary file upload vulnerability in the Ninja Forms - File Upload plugin on April 6, 2026. The flaw allows unauthenticated attackers to upload arbitrary files to a WordPress...
A high-severity vulnerability in Perfmatters, one of the most popular WordPress performance optimization plugins, allows authenticated attackers with nothing more than a subscriber account to delete a...
The first week of April 2026 brought 225 new WordPress vulnerabilities across 203 plugins and 22 themes. Of those, 134 have patches available and 91 remain unpatched. The headline story is a cluster o...
**Update, September 15, 2026:** This post originally said no patch existed for CVE-2026-3585. That was already wrong on the day it ran: The Events Calendar 6.15.17.1, which fixes it, shipped March 9,...
Two WordPress themes disclosed this week with CVSS 9.8 privilege escalation vulnerabilities. One has a patch available. The other does not. Both allow attackers to go from little or no authentication...
Every week the WordPress ecosystem produces a fresh wave of vulnerability disclosures. Most site owners never hear about them until something goes wrong. This report covers every significant disclosur...
When we launched WP Vanguard, we had a simple goal: make professional-grade WordPress security scanning accessible to every site owner, not just enterprises with big budgets. A few months in, we have...
Most WordPress site owners find out their site is down the same way their customers do: they try to visit it and get an error. They find out their SSL certificate expired when Chrome starts showing th...
The WordPress ecosystem saw a sharp wave of security disclosures over the past week. Multiple critical and high-severity vulnerabilities surfaced across popular plugins and themes, with one flaw activ...